Spam Filter ISP Support - Filter Rules / Order Question

Filter Rules / Order Question

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7148
Printed Date: 26 December 2024 at 10:35am

Topic: Filter Rules / Order Question

Posted By: insitec
Subject: Filter Rules / Order Question
Date Posted: 16 February 2017 at 12:07am

Hi Folks,

One of the things we're experiencing at the moment is a huge amount of spam that's being picked up by reverse DNS, or MAPS search; and is getting quarantined. Our issue is that around 90% of that spam would be set to 'do not quarantine' from a keyword match.

I don't want to set reverse DNS or MAPS to 'not quarantine' because we're still getting around 0.5% to 1% of emails on those categories being legitimate.

Any ideas? I've increased the number of countries we're blacklisting (and not quarantining), in an attempt to reduce it; but I'm keen to know how other people have tackled this issue?

Cheers,

Andy

Replies:

Posted By: LogSat
Date Posted: 16 February 2017 at 4:17pm

Andy,

This one is not going to be simple... SpamFilter does not allow the order of the filters to be changed, so the only option I can think of so far is to query the database to delete records that match your keywords from the database itself.

The difficulties are with the fact that SpamFilter's keywords can be plain or RegEx, there may be multiple keywords on one line, and that you may be using the ::NULL option for some of the keywords to tell SpamFilter to not quarantine the emails containing that keyword, but otherwise quarantine the others.

Are you configuring SpamFilter to not quarantine your entire blacklist keyword filter, or just individual keywords? What is your DB platform - SQL or MySQL?

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: insitec
Date Posted: 16 February 2017 at 9:27pm

Thanks Roberto,

I figured it was probably non-trivial!

We are using regex for most of our keywords, and we've got them all set to ::NULL. To confirm - we are not currently quarantining anything that filters on a keyword match.

We are using MSSQL as our database.

Cheers,

Andy

Posted By: insitec
Date Posted: 23 February 2017 at 11:01pm

We've been looking into this a bit more, and we were thinking we might have to write a custom database trigger.

The trigger would fire whenever a new message is quarantined, and it would immediately run a regex match of the keywords. If it gets a hit, it will delete the message.

Have you ever heard / seen anyone doing something similar, or is there something else you would suggest?

--Andy

Posted By: LogSat
Date Posted: 24 February 2017 at 8:15am

Yes, other users (us at LogSat included) employ database triggers to act upon new messages that are added to the quarantine. We fully support SpamFilter even with users making changes to the DB, even adding their own tables to obtain new functionality they need in their environment.

In regards to your need, I was personally thinking about a scheduled query within your SQL Server to perform the cleanup - the difficulty is with coming up with a query that will handle entries in SpamFilter's keyword list and "convert" them into keywords that SQL server can use. But once this query is discovered, applying it with a database trigger would indeed be better than a scheduled job.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP